Security advisories

medium2025-11-19

CVE-2025-64708-authentik's invitation expiry is delayed by at least 5 minutes

goauthentik/authentik · GHSA-ch7q-53v8-73pc

medium2025-11-19

CVE-2025-64521-authentik allows a deactivated Service account to authenticate to OAuth

goauthentik/authentik · GHSA-xr73-jq5p-ch8r

critical2025-11-19

CVE-2025-64408-Apache Causeway vulnerable to deserialization in Java

apache/causeway · GHSA-wq4c-57mh-5f7g

medium2025-11-19

CVE-2025-12119-MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory

mongodb/mongo-php-driver · GHSA-mwcc-7vpp-xmv9

critical2025-11-18

CVE-2025-60455-Modular Max Serve has Unsafe Deserialization vulnerability

modular/modular · GHSA-7xcv-9j6c-2fmc

medium2025-11-18

CVE-2025-65089-XWiki view file macro: User can view content of office file without view rights on the attachment

xwikisas/xwiki-pro-macros · GHSA-8c52-x9w7-vc95

medium2025-11-18

CVE-2025-65093-LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint

librenms/librenms · GHSA-6pmj-xjxp-p8g9

medium2025-11-18

CVE-2025-63828-Backdrop CMS Host Header Injection vulnerability

backdrop/backdrop · GHSA-ffpg-gm3h-4p5p

high2025-11-18

CVE-2025-64076-cbor2 C extension decoder flaws can cause denial of service

agronholm/cbor2 · GHSA-9q9c-vjxh-p795

low2025-11-18

CVE-2025-13083-Drupal core allows Exploiting Incorrectly Configured Access Control Security Levels

drupal/core · GHSA-mhpg-hpj5-73r2

medium2025-11-18

CVE-2025-13081-Drupal core allows Object Injection

drupal/core · GHSA-m6vv-vcj8-w8m7

low2025-11-18

CVE-2025-13082-Drupal core allows Content Spoofing

drupal/core · GHSA-h89p-5896-f4q8

low2025-11-18

CVE-2025-13080-Drupal core allows Forceful Browsing

drupal/core · GHSA-83v7-c2cf-p9c2

low2025-11-18

CVE-2025-55074-Mattermost allows other users to determine when users had read channels via channel member objects

mattermost/mattermost · GHSA-9hh7-6558-qfp2

critical2025-11-18

CVE-2025-12383-Eclipse Jersey has a Race Condition

eclipse-ee4j/jersey · GHSA-7p63-w6x9-6gr7

critical2025-11-18

CVE-2025-65015-joserfc has Possible Uncontrolled Resource Consumption Vulnerability Triggered by Logging Arbitrarily Large JWT Token Payloads

authlib/joserfc · GHSA-frfh-8v73-gjg4

low2025-11-18

CVE-2025-65014-LibreNMS has Weak Password Policy

librenms/librenms · GHSA-5mrf-j8v6-f45g

medium2025-11-18

CVE-2025-65013-LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`

librenms/librenms · GHSA-j8cq-7f6p-256x

medium2025-11-18

CVE-2025-65012-Kirby CMS has cross-site scripting (XSS) in the changes dialog

getkirby/kirby · GHSA-84hf-8gh5-575j

medium2025-11-18

CVE-2025-54990-XWiki AdminTools application doesn't set permissions on the AdminTools space

xwikisas/application-admintools · GHSA-v7r8-8p5c-h4xw